Description of problem:

Socket activation of certain SSSD services doesn't seem to work. Starting with an sssd.conf that is mostly generated by authconfig-tui it looks something like this:

[domain/default]

autofs_provider = ldap
cache_credentials = True
krb5_realm = #
ldap_search_base = o=Example Inc.
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://[::1]/
ldap_id_use_start_tls = False
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_default_bind_dn = cn=SSSD,ou=System,o=Example Inc.
ldap_default_authtok = secret
ldap_tls_reqcert = never
[sssd]
services = nss, pam, autofs

domains = default
[nss]
homedir_substring = /home

[pam]

[sudo]

[autofs]

[ssh]

[pac]

[ifp]

[secrets]

[session_recording]

This seems to work fine, "getent passwd <user>" finds users in the LDAP directory, and I can log in over SSH. So basically the NSS and PAM services at least are functioning.

If I try and convert to using socket activation by unsetting the "services =" line and then enabling the sssd-nss.socket, sssd-pam.socket, & sssd-pam-priv.socket systemd units, then the NSS service continues to work, but PAM stops working, i.e. I can no longer SSH in.

Looking at the logs, I can see this:

[sssd[pam]] [ldb] (0x0020): Unable to open tdb '/var/lib/sss/db/config.ldb': Permission denied
[sssd[pam]] [ldb] (0x0020): Failed to connect to '/var/lib/sss/db/config.ldb' with backend 'tdb': Unable to ope
[sssd[pam]] [confdb_init] (0x0010): Unable to open config database [/var/lib/sss/db/config.ldb]
[sssd[pam]] [server_setup] (0x0010): The confdb initialization failed

Those files are all owned by root. Looking at the sssd-pam.service shows it's trying to run as sssd:sssd whereas NSS at least is running as root. If I comment out the User= & Group= settings in the unit file then PAM starts working again. In fact, it says in the sssd.conf man page not to try running SSSD as anything other than root otherwise socket activation.

There seems to be User= & Group= settings in the PAM, AutoFS, Sudo, SSH and PAC units but not in NSS.

So, is this supposed to work out of the box?

Version-Release number of selected component (if applicable):

1.16.0-19.el7_5.8

How reproducible:

Always

Steps to Reproduce:
1. Configure SSSD with authconfig(-tui) as above
2. Test
3. Convert to socket activation and enable the various systemd socket units.
4. Test again

Actual results:

PAM stops working

Expected results:

PAM should keep working

Additional info: